Overview

overview

10

Static

static

10

2024-08-16...de.exe

windows7-x64

9

2024-08-16...de.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    147s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-08-2024 09:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-08-16_6edfb62405f50d7fb16882ca9b16ed36_darkside.exe

  • Size

    146KB

  • MD5

    6edfb62405f50d7fb16882ca9b16ed36

  • SHA1

    73c346267e9527ca5886bf8a90b77f9ebceb58fe

  • SHA256

    315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13

  • SHA512

    b3ea04a001c846af5d93435db055986a448fc5d01e86a9292937ce085609b653d41719111d2d031c8b6694eb01d5856e86f9e1a65e8cdc43af51a8ed3d370d2f

  • SSDEEP

    3072:PqJogYkcSNm9V7DGoNK696RTpfnEsCygHQlyT:Pq2kc4m9tDHNK6UlJ9CyN

Score
9/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Signatures

  • Renames multiple (595) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-08-16_6edfb62405f50d7fb16882ca9b16ed36_darkside.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-08-16_6edfb62405f50d7fb16882ca9b16ed36_darkside.exe"
    1⤵
    • Drops desktop.ini file(s)
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3408
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
      • Drops file in System32 directory
      PID:1512
    • C:\ProgramData\AF7B.tmp
      "C:\ProgramData\AF7B.tmp"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:540
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\AF7B.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:960
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
    1⤵
      PID:4860
    • C:\Windows\system32\printfilterpipelinesvc.exe
      C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
      1⤵
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:2360
      • C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
        /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{0B2B42BA-3A9B-4068-B244-9B7907F19EC9}.xps" 133682745224890000
        2⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious use of SetWindowsHookEx
        PID:3208

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\BBBBBBBBBBB
      Filesize

      129B

      MD5

      81b632c9df13c59ff508807be68189f3

      SHA1

      d54ca59582412813cad0828b1cc7f0a97c9383ba

      SHA256

      1ef566858819b06b8d5ca3d7583640c3df425f4817f203fe059ede1160e6b09d

      SHA512

      bac2143a2c5d92126e1c53a3dbd98e36566733dcd620725b4752eae7eee22a61307e9853b182f6eb001c93d71b3504cb7c059857594f71c3b403de110a2d291f

      Download Submit

    • C:\ProgramData\AF7B.tmp
      Filesize

      14KB

      MD5

      294e9f64cb1642dd89229fff0592856b

      SHA1

      97b148c27f3da29ba7b18d6aee8a0db9102f47c9

      SHA256

      917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

      SHA512

      b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
      Filesize

      146KB

      MD5

      fe179b97af566c67aebea512bea294e6

      SHA1

      cc2b77e95f617fbcfc2397f044dbb97c0dedeadc

      SHA256

      d32807f6a8245afbeb7c218f85840a72935f6bc42ef50826cc7df4bc260688a5

      SHA512

      d6fa88c84684ca8275eeab5fc163ade0edfea299bd77f4fb77e712c4360164c38f86414d1eab77429fec5d1602c09f736c9c3fa93b5fc4f7c5c338dc0f942c56

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\{5F9E143F-EDE4-4C4A-A0FE-9461E2C5C153}
      Filesize

      4KB

      MD5

      bda2afb8b206593a22f6ba8e20074dc5

      SHA1

      e47c80bdb431713d8411805974fcd6e97d7f3f21

      SHA256

      136b20968da1ce09bfe4b1014b93ec963c2a87a648d9655d6628a77c29699e6e

      SHA512

      3d166e6100be46222f413b2e8554ddafa57b2832589863bea87f042cd0a751bff4c4f3aa42a1171d4da701706f32cd77dcaab199a15138d75aa7c33e95565aee

      Download Submit

    • C:\raMFGAusF.README.txt
      Filesize

      597B

      MD5

      8b868d53629149c6b3a461ff64ce8cef

      SHA1

      b8a0b57cfe78c6d8468bdd5ef52411765a456e41

      SHA256

      5f8d2cdb81cac5d0b7df3bae0634042b305b4ac7ad06c728b21df0ea9628da25

      SHA512

      2fbb224b435621bc8947caf5aa4e294725f7df1c79dfaae1674086c8e92fcdb106d734680ac58e02b112613c778b582b2eaa8e6979dc1d75dc1dccab54f7c337

      Download Submit

    • F:\$RECYCLE.BIN\S-1-5-21-355097885-2402257403-2971294179-1000\DDDDDDDDDDD
      Filesize

      129B

      MD5

      aa2bcaa8b0c95a03e384e39accec2761

      SHA1

      98f5957c574833f51a4717cb40f36530b1fc8850

      SHA256

      3ab64a541825293feadd1cb4403737c6b78624ca5158d946261ab464e8ee8dd8

      SHA512

      eda1b173267bf6f40f2e88656e1272dfe12d63da356f20cfe420e7b5baf8d36b4a36514e47cc86b155dd8d02931f1b2b4ce1329ca816bafc21b925adbbd212c2

      Download Submit

    • memory/3208-2823-0x00007FF97C530000-0x00007FF97C540000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3208-2821-0x00007FF97C530000-0x00007FF97C540000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3208-2822-0x00007FF97C530000-0x00007FF97C540000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3208-2824-0x00007FF97C530000-0x00007FF97C540000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3208-2825-0x00007FF97C530000-0x00007FF97C540000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3208-2826-0x00007FF979E10000-0x00007FF979E20000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3208-2827-0x00007FF979E10000-0x00007FF979E20000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3408-2778-0x0000000002CA0000-0x0000000002CB0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3408-2777-0x0000000002CA0000-0x0000000002CB0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3408-2776-0x0000000002CA0000-0x0000000002CB0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3408-2-0x0000000002CA0000-0x0000000002CB0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3408-1-0x0000000002CA0000-0x0000000002CB0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3408-0-0x0000000002CA0000-0x0000000002CB0000-memory.dmp

      Filesize

      64KB

      Download